Programming Microsoft ASP.NET 4 - Dino Esposito [200]
Response.End();
return;
}
The IsCrossPagePostBack property on the Page class deserves a bit of attention. The property returns true if the current page has called another ASP.NET page. It goes without saying that IsCrossPagePostBack on the target page always returns false. Therefore, the following code is not equivalent to the one seen before:
if (!IsCrossPagePostBack)
{
...
}
To know whether the current page is being called from another page, you have to test the value of IsCrossPagePostBack on the page object returned by PreviousPage:
// PreviousPage is null in case of a normal request
if (!PreviousPage.IsCrossPagePostBack)
{
...
}
However, this code will inevitably throw an exception if the page is invoked in a normal way (that is, from the address bar or via hyperlinking, because PreviousPage is null). In the end, the simplest and most effective way to see whether a page is being invoked through cross-page postbacks is by checking PreviousPage against null.
Redirecting Users to Another Page
In addition to the PostBackUrl property of button controls, ASP.NET provides another mechanism for transferring control and values from one page to another—you can use the Server.Transfer method.
The URL of the new page is not reflected by the browser’s address bar because the transfer takes place entirely on the server. The following code shows how to use the method to direct a user to another page:
protected void Button1_Click(object sender, EventArgs e)
{
Server.Transfer("target.aspx");
}
Note that all the code that might be following the call to Transfer in the page is never executed. In the end, Transfer is just a page redirect method. However, it is particularly efficient for two reasons. First, no roundtrip to the client is requested as is the case, for example, with Response.Redirect. Second, the same HttpApplication that was serving the caller request is reused, thus limiting the impact on the ASP.NET infrastructure.
How can you retrieve values from within the transferred page?
You can use the same programming model as for cross-page postings and rely on a non-null PreviousPage property, DLR interaction, or the @PreviousPageType directive for strongly typed access to input fields. How can a page detect whether it’s being called through a server transfer or through a cross-page postback? In both cases, PreviousPage is not null, but the IsCrossPagePostBack on the PreviousPage object is true for a cross-page posting and false in the case of a server transfer.
Important
Passing values from one page to another is a task that can be accomplished in a variety of ways—using cross-page posting, server transfer, HTML forms, cookies, or query strings. Which one is the most effective? Cross-page posting and server transfer offer a familiar programming model but potentially move a significant chunk of data through the __PREVIOUSPAGE field. Whether this information is really needed depends on the characteristics of the target page. In many cases, the target page just needs to receive a few parameters to start working. If this is the case, HTML client forms might be more effective in terms of data being moved. HTML forms, though, require an ASP-like programming model.
Validation Controls
The first rule for writing more secure applications is ensuring you get the data right, before you actually start using it. Getting the data right requires you to pass any external input through a validation step. In ASP.NET, validation controls provide an easy-to-use mechanism to perform a variety of validation tasks, including testing for valid types, values within a given range, or required fields.
ASP.NET validation controls work on the server, but they can be configured to filter invalid input already on the client. This is accomplished using some JavaScript code that kicks in and performs validation as soon as the user tabs out of a monitored input field.
All ASP.NET validation controls inherit from the BaseValidator class which, in turn, descends from Label. All validators